exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Debian Security Advisory 3886-1

Debian Security Advisory 3886-1
Posted Jun 19, 2017
Authored by Debian | Site debian.org

Debian Linux Security Advisory 3886-1 - Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

tags | advisory, denial of service, kernel, vulnerability
systems | linux, debian
advisories | CVE-2017-0605, CVE-2017-1000364, CVE-2017-7487, CVE-2017-7645, CVE-2017-7895, CVE-2017-8064, CVE-2017-8890, CVE-2017-8924, CVE-2017-8925, CVE-2017-9074, CVE-2017-9075, CVE-2017-9076, CVE-2017-9077, CVE-2017-9242
SHA-256 | eaaea7c322ad777f9581281a967dd44345471bc13a1d10f9d1bb0857fbdb1b1a

Debian Security Advisory 3886-1

Change Mirror Download

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3886-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
June 19, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : linux
CVE ID : CVE-2017-0605 CVE-2017-7487 CVE-2017-7645 CVE-2017-7895
CVE-2017-8064 CVE-2017-8890 CVE-2017-8924 CVE-2017-8925
CVE-2017-9074 CVE-2017-9075 CVE-2017-9076 CVE-2017-9077
CVE-2017-9242 CVE-2017-1000364

Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks.

CVE-2017-0605

A buffer overflow flaw was discovered in the trace subsystem.

CVE-2017-7487

Li Qiang reported a reference counter leak in the ipxitf_ioctl
function which may result into a use-after-free vulnerability,
triggerable when a IPX interface is configured.

CVE-2017-7645

Tuomas Haanpaa and Matti Kamunen from Synopsys Ltd discovered that
the NFSv2 and NFSv3 server implementations are vulnerable to an
out-of-bounds memory access issue while processing arbitrarily long
arguments sent by NFSv2/NFSv3 PRC clients, leading to a denial of
service.

CVE-2017-7895

Ari Kauppi from Synopsys Ltd discovered that the NFSv2 and NFSv3
server implementations do not properly handle payload bounds
checking of WRITE requests. A remote attacker with write access to a
NFS mount can take advantage of this flaw to read chunks of
arbitrary memory from both kernel-space and user-space.

CVE-2017-8064

Arnd Bergmann found that the DVB-USB core misused the device
logging system, resulting in a use-after-free vulnerability, with
unknown security impact.

CVE-2017-8890

It was discovered that the net_csk_clone_lock() function allows a
remote attacker to cause a double free leading to a denial of
service or potentially have other impact.

CVE-2017-8924

Johan Hovold found that the io_ti USB serial driver could leak
sensitive information if a malicious USB device was connected.

CVE-2017-8925

Johan Hovold found a reference counter leak in the omninet USB
serial driver, resulting in a use-after-free vulnerability. This
can be triggered by a local user permitted to open tty devices.

CVE-2017-9074

Andrey Konovalov reported that the IPv6 fragmentation
implementation could read beyond the end of a packet buffer. A
local user or guest VM might be able to use this to leak sensitive
information or to cause a denial of service (crash).

CVE-2017-9075

Andrey Konovalov reported that the SCTP/IPv6 implementation
wrongly initialised address lists on connected sockets, resulting
in a use-after-free vulnerability, a similar issue to
CVE-2017-8890. This can be triggered by any local user.

CVE-2017-9076 / CVE-2017-9077

Cong Wang found that the TCP/IPv6 and DCCP/IPv6 implementations
wrongly initialised address lists on connected sockets, a similar
issue to CVE-2017-9075.

CVE-2017-9242

Andrey Konovalov reported a packet buffer overrun in the IPv6
implementation. A local user could use this for denial of service
(memory corruption; crash) and possibly for privilege escalation.

CVE-2017-1000364

The Qualys Research Labs discovered that the size of the stack guard
page is not sufficiently large. The stack-pointer can jump over the
guard-page and moving from the stack into another memory region
without accessing the guard-page. In this case no page-fault
exception is raised and the stack extends into the other memory
region. An attacker can exploit this flaw for privilege escalation.

The default stack gap protection is set to 256 pages and can be
configured via the stack_guard_gap kernel parameter on the kernel
command line.

Further details can be found at
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt

For the oldstable distribution (jessie), these problems have been fixed
in version 3.16.43-2+deb8u1.

For the stable distribution (stretch), these problems have been fixed in
version 4.9.30-2+deb9u1 or earlier versions before the stretch release.

We recommend that you upgrade your linux packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAllH7wxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0R38w/+MgLDpftRSRxAsR0QMJwt89Kmp8aw4X8NnUF2epaR0gSERD45BB9iB8Em
0QsP0hPqJZwmTDelo54EOKuJjcXEtAgHBLBAJj7AvGIJz1MKiJcsUQJItVUr6itA
KjJtab8IFYkXxg3aL3UiSed0+eWO+ODNuFk251/dvdYLv/IRGXfep24978ktM1mj
Gykywmvr9eOaSlRfr/cHYuO6v0No5wL8OGiPM+abl9i8lN/dXxllEEQEUm+me6O6
pnrBk0bGOh3fQS/lqhiv4q/T3V5ux56jgj/iu4L3YF3Neui/oc1Ip8wTPGhj/JuJ
4rwjoHSXRSLtHHModfL3O92Atu5n74ZjpbCpZnu/BMxwcqq8NxrOpht1dbB77auM
vkVtcKY7/fmlwgkbK2KQGmLmzcSxXN9GymR26DAVZbetWyLDoxkIrPJeamWK2I+T
A+cDBnx2QEzXazi7H73CqLREp11AndWRIqnHs1urVfa6Q3RUQG7zwg7MCEMP0vhv
qFsXLW3B6kNQPa9ptM+Y/cNHz4+5GfEI5eeoEQ4pw+4uopxRhCJwQ0/SiaSXG1vZ
2Pj9U0qOo7iDLCAKDWFDdCze4msPyOBoNKcxkbTz+EB5RQy3amXbexavjmXcWZ/4
GfRnMkwwFVlIN1rF9Vu/ehhi8iYDilL8+3gVgX2QyKlHYbS30dg=
=cr+H
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close